Method and system for Cheon resistant static Diffie-Hellman security

ABSTRACT

A method for providing Cheon-resistance security for a static elliptic curve Diffie-Hellman cryptosystem (ECDH), the method including providing a system for message communication between a pair of correspondents, a message being exchanged in accordance with ECDH instructions executable on computer processors of the respective correspondents, the ECDH instructions using a curve selected from a plurality of curves, the selecting including choosing a range of curves; selecting, from the range of curves, curves matching a threshold efficiency; excluding, within the selected curves, curves which may include intentional vulnerabilities; and electing, from non-excluded selected curves, a curve with Cheon resistance, the electing comprising a curve from an additive group of order q, wherein q is prime, such that q−1=cr and q+1=ds, where r and s are primes and c and d are integer Cheon cofactors of the group, such that cd≤48.

FIELD OF THE DISCLOSURE

The present disclosure relates to static groups in the field ofcryptography.

BACKGROUND

The Diffie-Hellman key exchange is a method of securely exchangingcryptographic keys over a public channel. In various systems, theprotocol uses a multiplicative group of integers modulo p, where p is aprime. A public value g is a primitive root of modulo p and is raised toan exponent that is secret on each side of the cryptographictransaction. Due to the features of multiplicative groups, the exchangeof two primitive roots, each raised to a secret for one of the parties,can be combined together to form a shared secret between the twoparties. Due to the discrete logarithm problem an eavesdropper is unableto easily derive the shared secret.

A variation or a special case of the Diffie-Hellman key exchangeutilizes elliptic curve cryptography (ECC). In ECC, the group is not amultiplicative group of a finite field, but rather a subgroup of anelliptic curve. The use of elliptic curves allows for a smaller groupsize than a multiplicative group to achieve the same level of security.

In some forms of Diffie-Hellman key exchange, one party may re-use asecret value many times. This practice may be called staticDiffie-Hellman. Jung Hee Cheon, in a paper entitled “Security analysisof the strong Diffie-Hellman problem.” Advances in Cryptology—EuroCrypt2006, LNCS 4004, pg. 1, Springer, 2006, which is incorporated herein byreference, found that in a group size q, if q−1 or q+1 has factors of acertain size, then the static Diffie-Hellman problem is actuallyconsiderably easier than best known attacks on the Diffie-Hellmanproblem. In particular, the Cheon algorithm involves the adversarychoosing various points Q and seeing a shared secret xQ by getting afirst participant to apply the static private key x to Q. Such Cheonattack makes the Diffie-Hellman protocol less secure.

BRIEF DESCRIPTION OF THE DRAWINGS

The present disclosure will be better understood with reference to thedrawings, in which:

FIG. 1 is a block diagram showing participants exchanging informationutilizing cryptographic modules;

FIG. 2 is a data flow diagram showing the establishment of a sharedsecret in an elliptic cryptography Diffie-Hellman system;

FIG. 3 is a process diagram showing a process for selecting aCheon-resistant curve;

FIG. 4 is a data flow diagram showing the establishment of a sharedsecret in an elliptic cryptography Diffie-Hellman system using specificcriteria; and

FIG. 5 is a block diagram of a simplified computing device capable ofperforming the embodiments of the present disclosure.

DETAILED DESCRIPTION OF THE DRAWINGS

The present disclosure provides a method for providing Cheon-resistancesecurity for a static elliptic curve Diffie-Hellman cryptosystem (ECDH),the method comprising: providing a system for message communicationbetween a pair of correspondents, a message being exchanged inaccordance with ECDH instructions executable on computer processors ofthe respective correspondents, the ECDH instructions using a curveselected from a plurality of curves, the selecting comprising: choosinga range of curves; selecting, from the range of curves, curves matchinga threshold efficiency; excluding, within the selected curves, curveswhich may include intentional vulnerabilities; and electing, fromnon-excluded selected curves, a curve with Cheon resistance, theelecting comprising a curve from an additive group of order q, wherein qis prime, such that q−1=cr and q+1=ds, where r and s are primes and cand d are integer Cheon cofactors of the group, such that cd≤48.

The present disclosure further provides a method for providingCheon-resistance security for a static elliptic curve Diffie-Hellmancryptosystem (ECDH), the method comprising: providing a system formessage communication between a pair of correspondents, a message beingexchanged in accordance with ECDH instructions executable on computerprocessors of the respective correspondents, the ECDH instructions usinga curve comprising: an additive group of order q, wherein q is prime,such that q−1=cr and q+1=ds, where r and s are primes and c and d areinteger Cheon cofactors of the group, such that cd≤48; an affineequation in the form y²=x³+ix, where i=√{square root over (−1)}; alength of 454 bits; a field size p=2⁴⁵⁴+(3×17×11287)²; an orderq=2⁴⁵²+(7×41117)²; r=(q−1)/8; and s=(q+1)/6.

The present disclosure further provides computing device for providingCheon-resistance security for a static elliptic curve Diffie-Hellmancryptosystem (ECDH), the computing device comprising a processor forexecuting program instructions configured to: provide a system formessage communication between a pair of correspondents, a message beingexchanged in accordance with ECDH instructions executable on computerprocessors of the respective correspondents, the ECDH instructions usinga curve selected from a plurality of curves, the selecting comprising:choose a range of curves; select, from the range of curves, curvesmatching a threshold efficiency; exclude, within the selected curves,curves which may include intentional vulnerabilities; and elect, fromnon-excluded selected curves, a curve with Cheon resistance, theelecting comprising a curve from an additive group of order q, wherein qis prime, such that q−1=cr and q+1=ds, where r and s are primes and cand d are integer Cheon cofactors of the group, such that cd≤48.

The present disclosure further provides a computing device for providingCheon-resistance security for a static elliptic curve Diffie-Hellmancryptosystem (ECDH), the computing device comprising a processor forexecuting program instructions configured for: providing a system formessage communication between a pair of correspondents, a message beingexchanged in accordance with ECDH instructions executable on computerprocessors of the respective correspondents, the ECDH instructions usinga curve comprising: an additive group of order q, wherein q is prime,such that q−1=cr and q+1=ds, where r and s are primes and c and d areinteger Cheon cofactors of the group, such that cd≤48; an affineequation in the form y²=x³+ix, where i=√{square root over (−1)}; alength of 454 bits; a field size p=2⁴⁵⁴+(3×17×11287)²; an orderq=2⁴⁵²+(7×41117)²; r=(q−1)/8; and s=(q+1)/6.

Reference is now made to FIG. 1, which show a system 10 for messagecommunication between a pair of correspondents. Specifically, in FIG. 1,a pair of correspondents A and B are connected by a data communicationlink 12. Each of correspondents A and B has a cryptographic module orunit 14 which performs public key cryptography operations according toestablished protocols to permit secure communication over link 12. Thecryptographic units 14 operate within a cryptographic domain whoseparameters are shared by other entities.

In one example, correspondents A and B utilize a Diffie-Hellman (DH) keyexchange. Specifically, a Diffie-Hellman key exchange uses a commutativegroup, which is a type of algebraic system with one binary operation andobeying certain axioms.

The group originally proposed by Diffie and Hellman is known as themultiplicative group of the finite field of size p, where p is a primenumber. Using such multiplicative group, the set of numbers {1, 2, . . ., p−1}, may have a binary operation defined to be multiplication modulop, which means multiplication after computing the remainder upondivision by p. This group is well-known in mathematics and was appliedto cryptography by Diffie and Hellman.

For illustration purposes, consider a small prime p=5. The binaryoperation, multiplication modulo p for the group can be represented inthe following table:

TABLE 1 Binary operation, multiplication modulo 5 x 1 2 3 4 1 1 2 3 4 22 4 1 3 3 3 1 4 2 4 4 3 2 1

In this group, we have for example 2×4=3. Specifically, a normalmultiplication 2×4=8, but in this group, the remainder is computedmodulo 5 which gives 3 since 8=1×5+3.

For any element g of a group, and some positive integral number x, wecan define g^(x) by applying the binary operation between x copies of g.This operation is called group exponentiation, and g is called the baseand x the exponent. In the case where the group is the multiplicativegroup of a finite field, group exponentiation is also called modularexponentiation.

Thus, for illustration, let p=5 as in Table 1 above. If g=2 and x=6,then in modular exponentiation, g^(x)=2⁶=4. This is because, underconventional exponentiation, 2⁶=64 and the remainder of 64 modulo 5 is4.

Group exponentiation can be done quite efficiently, even in a largegroup of size nearly 2²⁵⁶, using algorithms such as thesquare-and-multiply algorithm. This algorithm requires at most log₂ (x)group operations to compute g^(x). In a group size 2²⁵⁶, a groupexponentiation takes 512 group operations or less, which is typicallypractical.

A discrete logarithm is the inverse of group exponentiation. Thediscrete logarithm of y=g^(x) to the base g is x. Computing the discretelogarithm is a “hard” problem in some groups. The hardness of thisproblem is central to the security of Diffie-Hellman key exchange andrelated public-key cryptography algorithms, called the discretelogarithm problem (DLP). Hard is a term of art in cryptography and asused herein generally means beyond the reach of an adversary that mustbe prevented from breaking the system as long as the security of thesystem is deemed important. Mathematically, the term may mean that thesolution to the problem is unsolvable in asymptotic polynomial time.

Thus, public key cryptography relies on the DLP being hard.

Referring again to FIG. 1, in the Diffie-Hellman key exchange,contributor A generates a secret exponent x, and contributor B generatesa secret exponent y. A sends A=g^(x) to B, and B sends B=g^(y) to A.Contributor A computes z=B^(x) and contributor B computes w=A^(y). Thecomputed values are equal since z=g^(xy)=w, so both contributors havecomputed the same shared value w=z.

For groups in which the discrete logarithm problem is hard, it istypically believed that it is hard for an adversary E to compute z and wfrom g, A, and B. The problem is now known as the Diffie-Hellman problem(DHP). The DHP can be solved by solving the DLP: given A=g^(x), find xby solving the DLP, and then compute B^(x), by group exponentiation,thereby solving the DHP, since w=z=B^(x). Therefore, the DHP is noharder than the DLP. The DHP might be easier than the DLP, but in somecases, one can solve the DLP by solving the DHP, although the conversionmay be more costly.

The above is the basic general form of the Diffie-Hellman key exchange.

Subsequent to the Diffie-Hellman key exchange being described, ElGamalintroduced a method of using the same Diffie-Hellman groups for digitalsignatures, which allow contributors A and B to be sure of each other'smessages. ElGamal also clarified the Diffie-Hellman key exchange couldbe used to build public-key encryption schemes. In one example,contributor B can use a fixed Diffie-Hellman private key, whilecontributor A can use an ephemeral private key which has only one keyper message it wishes to send to contributor B.

Elliptic Curve Cryptography

Elliptic curve cryptography (ECC) may be viewed as a special case of theDiffie-Hellman system for public-key cryptography.

In ECC, the group is not a multiplicative group for a finite field, butrather a subgroup of an elliptic curve. As indicated above, one reasonto use ECC is that, for groups of the same size, the DLP is harder inECC than the DLP in classic DH groups. This allows for smaller groups tobe used for the same level of security. Although use of elliptic curve(EC) groups is slower than use of finite field (FF) groups of the samesize, because EC groups can be much smaller for the same level ofsecurity, they can have similar speeds for FF groups of the samesecurity.

In general, a curve is any 1-dimensional set of points. An algebraiccurve is defined by a polynomial equation. A planar curve is a curveembedded in a plane. One simple example of a planar algebraic curve, isa circle having the equation x²+y²=1 in the (x,y)-plane.

Every curve, according to the mathematical theory known as algebraicgeometry, has a number called its genus. Genus 0 curves include lines,circles, ellipses, parabolas and hyperbolas. Generally, a genus 0 curveis any curve whose points can be reversibly transformed into numbers,using only rational functions in both directions of the transformation.For example, a circle has a genus 0 by mapping the point (x,y) to thenumber w=y/(x+1). This mapping can be reversed by (x,y)=((1−w²)/(1+w²),2w/(1+w²)).

Consequently, a genus 0 curve can have only a component in the real(x,y) plane. While hyperbolas appear to have two components, these areconnected in the extension of the plane to the projective line, whichconsiders asymptotes to act like points at infinity.

The simplest class of curves after genus 0 curves are genus 1 curves.These are traditionally also called elliptic curves, due to theirorigins in measuring the arc length of an ellipse.

A simple form of an elliptic curve is a planar cubic curve. Planar cubiccurves are those defined by the cubic equation in the plane. A smallclass of cubic curves have genus 0, and these exceptions are calledsingular cubics. Otherwise, most cubic planar curves have genus 1.

A traditional form of cubic equation for elliptic curves is theWeierstrass cubic, which includes equations such as y²=x³+ax+b, where aand b are fixed numbers and (x,y) are the coordinates of points in theplane.

Other types of cubic equations are also interesting to study, and can beuseful in ECC.

The theory of algebraic geometry defines a group on the set of points ofan elliptic curve. More generally, every curve has an associated group,called its Jacobian group. For genus 0 curves, the group has size 1, soit is not very interesting or useful for cryptography. For genus 2 orhigher curves, the group is quite complicated, but these groups havereceived consideration for use in cryptography.

The Jacobian group of planar cubic curves is defined as follows. A pointO is fixed to be the group identity. By tradition this elliptic curve iswritten using addition for the binary operation. So instead of writingxy for a group operation applied to group elements x and y, we write X+Yfor group elements X and Y.

To add points X and Y, form the line L through X and Y. If X and Y arethe same point, then choose the line through X that is tangent to thecurve. Since the curve is cubic, the line intersects at either 0, 1, or3 points, where tangencies are counting as two points, and inflectionsare counted as 3 points.

Since the line L already intersects the curve in two points, it mustintersect the curve in 3 points. Two of these points are X and Y, thethird is point Z.

The same procedure may be done on another point O and on Z to obtainanother point, which serves as the definition of X+Y.

Since elliptic curves traditionally use addition instead ofmultiplication to write their group operation, the previous terminologyand notation for DH groups may be adjusted. The previous operation ofgroup exponentiation, written as g^(x), is now called scalarmultiplication, and is written as xG. Further, the discrete logarithm issometimes referred to as “elliptic curve discrete logarithm problem”(ECDLP) as needed to avoid confusion with the discrete logarithm problemin other groups.

The elliptic curve Diffie-Hellman (ECDH) groups used in cryptographyrepresent the coordinates of a point with a finite field. Thus, finitefield Diffie-Hellman groups (FFDH groups) and ECDH groups both usefinite fields. In FFDH groups, a group element is a nonzero finite fieldelement. In ECDH groups, a group element is typically a pair of finitefield elements, which together satisfy a cubic equation. The finitefield used in ECDH groups is typically called the underlying field ofthe curve and of the ECDH group. In some embodiments, the term field ofdefinition is also used.

As indicated above, one advantage of the ECDH group is that the discretelogarithm problem seems to be harder for a group size than the FFDHgroup. Thus, if we choose an ECDH group and an FFDH group in which thediscrete logs are about equally hard, and too hard for any practicalalgorithm to solve, then typically the ECDH group will be faster forusers.

One main reason that an FFDLP is easier than an ECDLP is that FFDHgroups have better notions of large and small elements. These notions ofsize in FFDLP permit discrete logs by breaking large elements intocombinations of smaller elements, whose discrete logarithms are easierto find. This general strategy to solving the FFDLP is sometimes calledindex calculus or sieving. No effective index calculus algorithms havebeen discovered for typical elliptic curve groups.

In most ECDH groups, the best known algorithms to compute discrete logsare generic group algorithms. Generic group algorithms work in anygroup, and simply use group operations as a black box. The speed of thegeneric group algorithms for computing the discrete log is limited.Specifically, if the group has a size divisible by a prime n, thencomputing discrete logs with generic group algorithms at significantsuccess rate requires at least approximately n^(1/2) group.

Some rare cases of elliptic curves have discrete logs that are easier tosolve. These may be solved using the Menezes, Okamoto, Vanstone (MOV)attack and the Satoh, Araki, Semaev, Smart (SASS) attack. These rarecases can be detected easily and standards for ECC explicitly avoidthese special-case attacks.

Further, beyond the hard discrete logarithm problem, secure ECC needs toavoid side-channel attacks. Side channels arise when the implementationof ECDH and other algorithms leak additional information, such asinformation about correspondents A and B.

In static Diffie-Hellman, as described below, security is desirableagainst side channels. This is defined in accordance with the following.Suppose that correspondent A has a secure key m and a static DH modulethat computes mP for any input P in a given static Diffie-Hellman securegroup. Further suppose that the module leaks no absolutely no otherinformation about m (so the module has no side-channels or computes nosignatures with m). In this case, correspondent A can use the module inany set of protocols whatsoever without revealing m. Further, even ifthe protocols are insecure, they may compromise each other, but theywill not reveal m.

Care is needed to implement such ECDH without side channels. In someembodiments, certain algorithms are found to be easier to implementwithout side channels and one such algorithm is the Montgomery ladder.

An efficient form of the Montgomery ladder uses equations of the form:by²=x³+ax²+x.

The above equation is cubic and generally defines an elliptic curve. TheMontgomery ladder equation above is not usual in the Weierstrassequation, and has historically not been preferred by mathematicaltreatments of elliptic curves since it is slightly less general than theWeierstrass equation.

In elliptic curve cryptography, the equations are defined over a finitefield rather the usual numbers on a real line. Typically, the finitefield is a prime field and has integers modulo a prime p. This helpsensure that the points in the group are easily represented within afinite amount of information, and also helps to ensure that the discretelogarithm problem is hard.

Much of the efficiency for the ECC users depends on the choice of p,since the arithmetic involves computing remainders modulo p. By choosingp close to a power of two, or some other special form, the speed of ECCin software nearly doubles compared to a random prime p.

The use of ECDH is provided, for example, to obtain a shared secret overa public connection. Reference is now made to FIG. 2.

In FIG. 2, correspondent A and correspondent B wish to communicatesecurely over a public channel 12. Correspondents A and B agree to useelliptic curve Diffie-Hellman to obtain the shared secret forcommunication.

In particular, correspondent A may choose the curve and parameters andcommunicate these to correspondent B in order to assure the use of thesame curve between the parties.

Further, each of correspondents A and B have a secret integer value,which may be considered the private key for each correspondent. Thus,correspondent A has a secret integer m and correspondent B has a secretinteger n.

The parameters that are shared may include p, which is a prime numberthat indicates the order of the field F_(p). Parameters a and b are thevalues from the Weierstrass equation y²=x³+ax+b. The parameters furtherinclude the group generator G which has an order q.

Referring again to FIG. 2, at the initiation of the session,correspondent A sends, in message 212, parameters p, a, b, G, q tocorrespondent B. Message 212 further includes the value mG, which may beconsidered the public key for correspondent A.

Correspondent B receives message 212 and extracts the parameters.Correspondent B then provides value nG, which may be considered thepublic key for correspondent B, back to correspondent A in message 220.

Correspondent B further utilizes the curve to calculate the sharedsecret nmG using its private key along with the public key ofcorrespondent A.

Similarly, correspondent A utilizes the curve to calculate the sharedsecret mnG using its private key along with the public key ofcorrespondent B.

Since nmG=mnG the correspondents A and B now have a shared secret.

An eavesdropper 230 can see all communications between correspondents Aand B. Therefore eavesdropper 230 will know the curve parameters, alongwith public keys mG and nG. However, due to the discrete logarithmicproblem, the eavesdropper will be unable to calculate shared secret nmG.

The present disclosure relates to determination of a curve and curveparameters.

Point Counting

One of the main challenges in choosing an elliptic curve group forcryptography is determining its size. Although elliptic curveDiffie-Hellman (ECDH) can be operated without knowledge of the group'ssize, its security depends on the largest prime factor of the group'ssize due to the Pohlig-Hellman and Pollard rho algorithms. Inparticular, using ECDH with a group of unknown size n carries a riskthat the largest prime factor of n is too small.

Other cryptographic applications of elliptic curve groups, such asdigital signatures, may need direct knowledge of the group's size inorder to work properly.

Schoof-Elkies-Atkin (SEA) is a general method of determining the size ofan elliptic curve group. Counting the number of points on a randomelliptic curve over a finite field of the sizes needed for securecryptography using the SEA method takes, typically, under a second for256-bit curves or under a minute for larger curves of a 512-bit field.

Based on this, point-counting is practical unless one needs to try avery large number of elliptic curves in order to meet strict criteria.However, in the embodiments described herein, curves are sought thatneed to meet very strict criteria. These rather strict criteria may meanthat millions of curves need to be tried and a million minutes isapproximately 2 years.

Certain elliptic curves over finite fields are special in the sense ofhaving a small value for their fundamental determinant D. Thefundamental determinant is a number that relates the size n of the curveto the size p of the underlying field. Such curves are often describedas having complex multiplication (CM), and are called CM curves. CMcurves are rare and typically a random curve has very large discriminantD.

Knowing p and D allows one to determine n quickly. Furthermore, if D issmall, it is possible to find a curve with fundamental determinant D.This is part of the complex multiplication method.

One form of the CM method is to fix p, and try various small D until acurve with suitable properties is found. Searching using the CM methodis much faster than searching using the SEA method.

Another variant of the CM method fixes D to a very small value, in whichcase finding the curve is trivial. The method then searches throughdifferent possible values of p. This method is faster because it avoidsthe slowest steps of the previous CM method, which is finding the curvefrom various small D. The main disadvantage of the method is that itrequires considering various p values.

The embodiments described herein utilize the above method, with a fixedD and a varying p. Because the method is fast, it can be used to findcurves meeting very strict criteria.

The Static Diffie-Hellman Problem

In some form of Diffie-Hellman key exchange, contributor A will re-usethe secret value many times. This practice can be called staticDiffie-Hellman.

Examples of static Diffie-Hellman includes ElGamal encryption and itsvariants elliptic curve integrated encryption scheme (ECIES), a recentlyproposed optimized layer security (OPTLS) key agreement algorithm fortransport layer security (TLS) ⅓, and the Ford-Kaliskipassword-hardening scheme.

Thus, the static Diffie-Hellman problem is a variant of the generalDiffie-Hellman problem in which an adversary tries to exploit theconstant re-use of a secret value.

Static Diffie-Hellman groups protect some cryptographic protocols fromthe risk of certain types of failures. Specifically, an additive groupof order q is a static Diffie-Hellman group if, for a uniformly randomsecret integer aϵ{0, 1, 2, . . . , q−1}, no feasibly-efficient algorithmcan use an oracle A for the function that computes A(P)=aP (for anyinput P in the group) to find the secret a. Quantitatively: a group is(c, o, s) static Diffie-Hellman secure if no algorithm costing at most cgroup operations, making at most o queries to the oracle A, has successrate at least s at finding secret a.

Diffie-Hellman group security is provided through three notions. First,a discrete logarithm group is a group in which the discrete logarithmproblem (computing a from aP) is infeasible, and discrete logarithmsecurity quantifies how difficult the problem is.

Second, Diffie-Hellman security quantifies the difficulty of theDiffie-Hellman problem (computing abP from aP and bP), withDiffie-Hellman groups being those with intractable Diffie-Hellmanproblem.

Third, Diffie-Hellman groups and security are defined similarly.

The Cheon Attack

As indicated above, the Cheon attack showed that, if a group size q issuch that q−1 or q+1 has factors of a certain size, then the staticDiffie-Hellman problem is actually considerably easier than the bestknown attacks on the Diffie-Hellman problem.

The Cheon algorithm involves an adversary choosing various points Q andseeing correspondent A shared secret xQ by getting correspondent A toapply her static private key x to Q.

Some Diffie-Hellman protocols are believed to thwart Cheon's attack inany group. Correspondent A could, for example apply a key derivationfunction to xQ to get key k, and then correspondent A discards xQ. Ifthe key derivation function is one-way then in practice this couldthwart the Cheon algorithm. Nonetheless, it may be safer to also rely onCheon's algorithm not being feasible in the first place, rather than torely on a key derivation function and the secure deletion of xQ.

In other words, choosing a group in which Cheon's attack is infeasibleprovides a second tier of defence against a Cheon attack, where thefirst tier of defence would be the key derivation function itself.

In other cases, such as for example the Ford-Kaliski password-hardeningthe xQ may be made public. However for such groups, the need to resistthe Cheon attack is much stronger.

Thus, in accordance with the embodiments of the present disclosure, aCheon resistant curve is a curve that has a group size q such that bothq−1 and q+1 avoid the factorization conditions that make Cheon'salgorithm faster than Pollard rho.

In accordance with the above, Cheon resistance is defined as follows. Anadditive group of order q is near-optimally Cheon-resistant if q isprime, and q−1=cr and q+1=ds for primes r and s and integers c and dsuch that cd≤48. The pair (c, d) are the Cheon cofactors of the group.

In the above, the condition on the Cheon cofactors (c,d) is arbitraryand chosen for simplicity. In an alternative embodiment, a morecomplicated definition may be provided. For example, for each prime q,consider optimal parameters the Cheon's algorithm. Let c be the cost cof this optimal version of Cheon algorithm against a generic group ofsize q. Let q=log_(q)(c). Now consider a set of candidate primes q thatare potentially suitable for implementation of static Diffie-Hellman.For example, the set might be all primes of some bit length. Let

₊ be the maximum value of

_(q) for all candidate values of q. An alternative definition ofnearly-optimal Cheon-resistant group size q is that

_(q)=(1−ϵ_(q))

₊ under some definition of a small upper bound on ϵ_(q). Thisalternative definition, though not complete, is already almost toocomplicated for any practical application, hence the simpler definitionabove.

Subverted Cryptographic Algorithms

Another consideration for choosing curves is the avoidance ofcryptographic algorithms that have been deliberately subverted to bevulnerable to secret attacks. One known countermeasure to subvertedcryptographic algorithms is to choose an algorithm whose overalldescription is very compact. A compact algorithm tends to prevent thepossibility of a saboteur tinkering with the algorithm parameters bytrial and error. In this case, a trial-and-error search could force weakparameters to be relatively large, and thus less compact than morehonest parameters. As used herein, “honest” means parameters oralgorithms that are not specifically chosen to be weak. Suchcountermeasure is often called “nothing-up-my-sleeve”. More recently, ithas been called “rigidity”, with a slightly different meaning.

Therefore, in accordance with another embodiment of the presentdisclosure, a compact algorithm is chosen. While choosing the compactalgorithm does not protect against all sabotage, in some cases theweakest versions of algorithms have the smallest values of theparameters and thus are more compact and more honest versions of thealgorithm. The main countermeasure to sabotage this form is to properlyidentify the weak versions of the algorithm. In other words, traditionalcryptanalysis is utilized. A secondary countermeasure it to prove thatequivalence of any hypothetical attacks over any values of thealgorithm's parameters.

Based on the above, given that Cheon-resistant curves are desirable, andthat some protocols need to rely on the security of the staticDiffie-Hellman problem, the present disclosure provides for ellipticcurves that are more likely to have optimal static Diffie-Hellmansecurity, as constrained by other characteristics of the curves.

Conversely, one does not want to sacrifice important properties of theDiffie-Hellman, either security or efficiency. Therefore, the challengeis to boost evidence for Cheon resistance of a static Diffie-Hellmangroup, without compromising other features.

In accordance with one embodiment of the present disclosure, a set ofvery specific criteria may be established in order to solve the maindeficiency of most other elliptic curve proposals, namely the risk ofweak static Diffie-Hellman problem.

Particularly, various criteria exist for both security and efficiency ofthe elliptic curve. These include resistance to the usual elliptic curveattacks such as: large bit length to resist Pollard rho attack; smallcofactor to resist Pohlig-Hellman attack; high embedding degree toresist MOV attack; curve order not equal to field order to resist SASSattacks; and cofactor divisible by four for better side-channelresistance and efficiency.

However, these basic criteria do not address the risk of a weak staticDiffie-Hellman problem. Accordingly, a further criterion is added inaccordance with the present disclosure to the above basic criteria andthat is that Cheon's attack is resisted nearly optimally for a bitlength in order to implement strong static Diffie-Hellman security.

Since Cheon-resistance is an advanced security property, the presentdisclosure provides an emphasis on security rather than efficiency.Therefore, rather than opt to choose the most efficient or smallestcurve of adequate security, in accordance with the present disclosure arange of more secure or larger curves of adequate efficiency areconsidered. Among such curves, efficiency is sought utilizing thefollowing criteria: small enough bit length to be practical; relativelyefficient for bit length including field size close to a power of twoand an efficient endomorphism.

Further, in accordance with the embodiments of the present disclosure,some effort, or by-products of the above criteria, are applied toaddress concerns of intentionally vulnerable cryptographic algorithms.These include factors including that the curve is compact. Inparticular, all the curve's parameters are compact, expressible as acompressed form. Further, the curve is compact by ensuring the curve wasnot maliciously manipulated.

The vulnerabilities are addressed through ease of generation andregeneration. Thus, in accordance with the embodiments described below,only seconds are needed to check each candidate curve on an older PCmodel rather than months on a cluster of servers.

In accordance with the above, in one embodiment a near-optimallyCheon-resistant elliptic curve with complex multiplication by isuggesting superior Boneh-Boyen static Diffie-Hellman security andadmitting a Bernstein ladder, with length of 454 bits, referred toherein as Crib454, is provided. However, this curve is merely oneexample, and the principles described herein can be applied to findother curves matching the criteria described.

The criteria for Crib454 is based on both security and efficiency asdescribed below.

The CRIB454 curve is described utilizing the following criteria:p=2⁴⁵⁴+(3×17×11287)²q=2⁴⁵²+(7×41117)²r=(q−1)/8s=(q+1)/6

The above criteria are probable primes.

Further, the elliptic curve with affine equation is defined as:y²=x³+ix.

The above curve has n=4q points, including a point at infinity, over afield F_(p) of size p As usual, i≡(−1)^(1/2) mod p. In this respect,i≡2²²⁷/(3×17×11287) mod p.

The above criteria provide one example of a curve that may be used inaccordance with the present disclosure. Other curves, based on thefactors provided below, may also be used.

For ease of generation, efficiency and compactness, the specificcriteria require complex multiplication (CM). Further, complexmultiplication by i was chosen since such multiplication provides veryefficient endomorphism and matches with the cofactor 4 criteria. Thealternative linear endomorphism curves have complex multiplication by acube root of unity, but these have a cofactor 3, which may be lessdesirable.

While it has been suggested in the art that curves with complexmultiplication are risky, in 30 years no attacks on CM curves havematerialized, which provides strong evidence that CM curves are as goodas non-CM curves. In fact, two reasons that CM curves might offer bettersecurity than non-CM curves include, first, that efficient endomorphismpermits use of a larger curve, which increases the difficulty of knownattacks for a given level of efficiency, and potentially provides amargin of error against mild attacks on CM. In this case, mild isdefined in the sense of being only slightly better than Pollard rhoattacks.

Secondly, CM curves belong to a special class of curves, whichpotentially avoid some problems of most non-CM curves. For example,consider resistance to Pohlig-Hellman attacks, which is strongest forthe special class of almost-prime (low cofactor) DH groups. Otherexamples exist to show that special curves may be safer than non-CMcurves.

There only a few elliptic curves, up to isomorphism, over a given primefinite field, having complex multiplication by i. Some of these have acofactor divisible by 8 and therefore should be avoided. This typicallyfixes the curve equation, up to isomorphism.

For Cheon-resistance security, the embodiments of the present disclosureattempt to select near-optimal Cheon resistance relative to curve size,as this can be viewed as the strongest evidence for having a strongstatic Diffie-Hellman security. To achieve this near-optimalCheon-resistance, the Cheon cofactors were then defined to be nearlyminimal. In the notation of Crib454, the chosen Cheon cofactors are 8and 6, because r=(q−1)/8 and s=(q−1)/6. In the above, group order is theprime q, while r and s are primes related to q.

The specific choice of Cheon cofactor pair (8,6), instead of (1,1) or(6,8) or (2,24) was made for two reasons. First, some pairs like (1,1)are impossible due to the divisibility properties of numbers involved.Indeed, the product of the numbers in the pair should be divisible by12, because the product of the two numbers adjacent to any prime largerthan or equal to five is divisible by 12.

Specifically, if q is such a prime, then q−1 or q+1 must be divisible by3. Both q−1 and q+1 are even and one must be divisible by 4.

Secondly, the prime p, which is the size the underlying field, wasselected to a have a special form. Specifically, the special form is aquasi-Fermat prime because this form permits fairly good efficiency forits size. This special form implies that the first Cheon cofactor isdivisible by 8, and the product of the Cheon cofactors is divisible by48.

The general criteria for p is that it is simple, compact and efficient.The specific criteria is that p is a power of two plus or minus a smallnumber. In some embodiments, the smaller the number the better. With pbeing a power of two plus or minus a small number, p is very simple,compact and efficient. The specific criteria that p be a quasi-Fermatprime, which it is a power of two plus a small number (not minus), seemsto be imposed by the abbreviated form of the CM method.

The abbreviated form of the CM method is a further criterion. In thisform of the CM method, the usual step of determining q from p, viaCornacchia's algorithm, is replaced by a simpler formula, in which bothp and q are calculated from some given integers. The abbreviatedapproach is faster than the usual CM method because it avoidsCornacchia's algorithm, which aids in the reproducibility of the method.

The abbreviated method also results in a more compact form for p and q,which aids in arguing that the curve was not manipulated, since it lacksany random-looking parameters.

The last specific criterion is defining how to measure closeness to thepower of two. For this, a simple and natural rule as possible waschosen. Rather than using absolute differences as a measure ofcloseness, a relative difference was used. Specifically, the relativedifference is the absolute difference divided by the exponent to thepower of two.

For example, in Crib454, p=2⁴⁵⁴+(3×17×11287)², so the relativedifference is (3×17×11287)²/454. The relative difference is more naturalthan the absolute difference, because of the prime number theorem, whichgives heuristic predictions of the probability of numbers being prime.Under this heuristic, the rarity of primes is a function of the relativedifference, not the absolute difference.

The closeness to the power of two is the last and thus it is given thelowest priority of the criteria. Thus, the other criteria are decidedfirst, but the previous criteria can all be expressed in the formula.Thus it only remains to do the calculations, most consisting ofprimality tests. This generates a list of candidate curves. Of thesuitable curves, the one having minimal relative difference is selected.

One computer algorithm for doing the above is provided in Appendix A.The computer code in Appendix A verifies the Crib454 criteria, but couldeasily be adapted by those skilled in the art to produce other curvesmeeting the criteria above.

Further, the above may be summarized with reference to FIG. 3. Inparticular, FIG. 3 shows a flow diagram for the derivation of a curvethat has near-optimal Cheon resistance.

The process of FIG. 3 starts at block 310 and proceeds to block 312 inwhich a range of curves is chosen. Specifically, the size of the curvemay be determined at block 312 to meet minimal security requirements forthe ECDH application.

From block 312 the process proceeds to block 320 in which the range ofcurves from block 312 is further reduced to select a curve with athreshold efficiency. In particular, the selected curve as describedabove should be small enough to be practical. Further, the field sizeshould be close to a power of two. Further, the selection at block 320should limit the curves to those exhibiting efficient endomorphism.

From block 320 the process proceeds to block 330 in which the curvesselected at block 320 are further reduced to eliminate curves that mayexhibit vulnerabilities. In particular, at block 330 the selected curvesare reduced to those that are compact and not maliciously manipulated.Further, the curves are reduced to those that are easy to generate.

From block 330 the process proceeds to block 340 in which Cheonresistance is ensured by ensuring the curves avoid the factorizationconditions that make Cheon's algorithm faster than Pollard rho.

The process then proceeds to block 350 and ends.

Using the Crib454 parameters above, reference is now made to FIG. 4. Inparticular FIG. 4 shows the embodiment of FIG. 2 in which the genericparameters for the curve are specifically substituted for the Crib454parameters.

Thus, correspondent A communicates with correspondent B over a securechannel. In the embodiment of FIG. 4 correspondent A sends message 412,which includes p=2⁴⁵⁴±(3×17×11287)² and q=2⁴⁵²±(7×41117)². Further, a=iand b=0. G is any fixed point on the curve provided it has order q.

Correspondent A further sends its public key mG in message 412 tocorrespondent B. However, in other embodiments the public key may besent in a subsequent message.

Correspondent B sends its public key nG to correspondent A in message420.

At this point, due to the curve parameters and the public keys, each ofcorrespondents A and B can calculate the shared secret, whileeavesdropper 430 cannot calculate the shared secret due to the discretelogarithmic problem. Further, the eavesdropper 430 will be unable to usethe Cheon attack due to the Cheon resistance built into the curveparameters.

The above may be implement using any computing device. For example, onesimplified computing device is provided with regards to FIG. 5.

In FIG. 5, device 510 includes a processor 520 and a communicationssubsystem 530, where the processor 520 and communications subsystem 530cooperate to perform the methods of the embodiments described above.

Processor 520 is configured to execute programmable logic, which may bestored, along with data, on device 510, and shown in the example of FIG.5 as memory 540. Memory 540 can be any tangible, non-transitory computerreadable storage medium. The computer readable storage medium may be atangible or in transitory/non-transitory medium such as optical (e.g.,CD, DVD, etc.), magnetic (e.g., tape), flash drive, hard drive, or othermemory known in the art.

Alternatively, or in addition to memory 540, device 510 may access dataor programmable logic from an external storage medium, for examplethrough communications subsystem 530.

Communications subsystem 530 allows device 510 to communicate with otherdevices or network elements.

Communications between the various elements of device 510 may be throughan internal bus 560 in one embodiment. However, other forms ofcommunication are possible.

The structure, features, accessories, and alternatives of specificembodiments described herein and shown in the Figures are intended toapply generally to all of the teachings of the present disclosure,including to all of the embodiments described and illustrated herein,insofar as they are compatible. In other words, the structure, features,accessories, and alternatives of a specific embodiment are not intendedto be limited to only that specific embodiment unless so indicated.

Furthermore, additional features and advantages of the presentdisclosure will be appreciated by those skilled in the art.

The embodiments described herein are examples of structures, systems ormethods having elements corresponding to elements of the techniques ofthis application. This written description may enable those skilled inthe art to make and use embodiments having alternative elements thatlikewise correspond to the elements of the techniques of thisapplication. The intended scope of the techniques of this applicationthus includes other structures, systems or methods that do not differfrom the techniques of this application as described herein, and furtherincludes other structures, systems or methods with insubstantialdifferences from the techniques of this application as described herein.

APPENDIX A Code used to generate CRIB454 // strong_ecdh.cc // Dan Brown// 2015-August-25 // Compile using: // g++ −O3 strong_ecdh.cc -Intl //Try to find triples (t,z,u) with u= +/−1, such that the following //numbers: // p = 2^(∧)(2t) + (12z+2u+1)^(∧)2 // q = 2^(∧)(2t−2) +(6z+u)^(∧)2 // r = (q−1)/8 // s = (q+1)/6 // are prime. (If t,z,u areintegers and t >= 3, then p,q,r,s are // integers.) // Note t−1 looselycorresponds to “security level” // Like t >= 127 for sufficient DHsecurity. // Like t <= 300 for practical DH performance. // Look atsmaller and larger t just for completeness. // Like |z| as small aspossible for efficiency. // Try |z| < t^(∧)d for d=1,2,3,4, gettingsuccessively more hits. # include <NTL/ZZ.h> using namespace std ; usingnamespace NTL ; // T_MAX is maximum size of t, a constant // Z_ABS ismaximum size |z|: e.g. expresion in t # if 0 # elif 1 // Crib454 onlynon-trivial hit // Slowly test for medium |z| // Found Crib454 in ~ 4sec on old PC # define Z_ABS t*t // # define T_MAX 400 // Took ~ 30 secto1.5 min old PC // 500 // Took ~ 2-5 min on old PC // Don't expect anynon-trivial hits, since not enough z // Got five trivial hits plus //(t,z,u) = (227,−47970,1) // yielding the interesting elliptic curveCrib454! // other test parameters given below . . . # elif 0 // Quicklytest for smaller |z|, but larger t. # define Z_ABS t # define T_MAX /*1024 // Took ~ 10 sec on old PC */ \ 3072 // Took ~ 7 min on old PC. //Don't expect (m)any hits for non-trivial t. // Trivially small hits: //(t,z,y) = (3,2,1) ---> (p,q,r,s) = (593, 137, 17, 23) // (t,z,u) = (6,−2, −1) ---> (p,q,r,s) = (4721, 1193, 149, 199) # elif 0 // Allowslightly larger |z| than for Crib454 # define Z_ABS 10*t*t // # defineT_MAX 300 // Took ~ 1.5 min on old PC // new hit: (t,z,u) =(173,−125658,−1) 20 # elif 1 // __SLOWLY__ test for medium |z| // // !!!--- very slow, e.g. > 30min --- !!! // # define Z_ABS t*t*t # defineT_MAX 300 // took ~46min on old PC // Decent chance of a hit for each t.// Most interesting outputs: // log_t(|z|) // (t,z,u) = (116,−1330894,1)// 2.966 // (t,z,u) = (159,−522010,1) // 2.597 // (t,z,u) =(161,−3559998,−1) // 2.969 // (t,z,u) = (173,−125658,−1) // 2.278 //(t,z,u) = (224,−2710302,−1) // 2.737 // (t,z,u) = (227,−47970,1) //1.987 // (t,z,u) = (289,13349730,1) // 2.895 # else // Sanity check: #define Z_ABS t*t*t*t # define T_MAX 128 # endif // Expect many hits . .. need to limit # per t. // Got 7 hits at t = 32. // For <=256-bitfield, the most interesting example: // (t,z,u) = (127,−10402698,−1) //Convert |z| bound into a string. # define STRING_1(x) #x # defineSTRING_2(x) STRING_1(x) # define Z_STRING STRING_2(Z_ABS) // FollowingNTL style guide to use long instead of int. bool five_or_more_test (longt, long z, long u) { // for meaning of t,z,u, see comments in functionmod_test. // uncomment this to remove sieving test . . . // return true; // Much slower! // Sieving risks knocking trivially small t . . . //so let's skip sieving for small t if ( t <= 15 ) { // note r >=2^(∧)(2t−5). // If t>20, then r > 2^(∧)35 // If t>15, then r> 2^(∧)25return true ; } # define SIEVE_MAX ((sizeof (primes))/(sizeof (long)))const long primes[ ] = { // what is the most efficient set of primes toput here? // the savings are achieved by avoiding big integer math . . .// it's silly to include the list of primes in the code // shouldinstead generate them at a start-up. // it seems to make sense to sievepretty far given the NTL // primality testing interface. Although NTLcould try trial // division, which should not be significantly slowerthan the // stuff here, it will also do Miller--Rabin on one of p,q,r,s// before doing trial division on the others. 5,7, 11,13,17,19, 23,29,31,37, 41,43,47, 53,59, 61,67, 71,73,79, 83,89, 97, 101,103,107,109,113, 127, 131, 137,139, 149, 151,157, 163,167, 173,179, 181,191,193,197,199,211,223,227,229,233,239,241,251,257,263,269,271,277,281,283,293,307,311,313,317,331,337,347,349,353,359,367,373,379,383,389,397,401,409,419,421,431,433,439,443,449,457,461,463,467,479,487,491,499,503,509,521,523,541,547,557,563,569,571,577,587,593,599,601,607,613,617,619,631,641,643,647,653,659,661,673,677,683,691,701,709,719,727,733,739,743,751,757,761,769,773,787,797,809,811,821,823,827,829,839,853,857,859,863,877,881,883,887,907,911,919,929,937,941,947,953,967,971,977,983,991,997, /* Thefollowing does not help too much, except for larger t */1009,1013,1019,1021,1031,1033,1039,1049,1051,1061,1063,1069,1087,1091,1093,1097,1103,1109,1117,1123,1129,1151,1153,1163,1171,1181,1187,1193,1201,1213,1217,1223,1229,1231,1237,1249,1259,1277,1279,1283,1289,1291,1297,1301,1303,1307,1319,1321,1327,1361,1367,1373,1381,1399,1409,1423,1427,1429,1433,1439,1447,1451,1453,1459,1471,1481,1483,1487,1489,1493,1499,1511,1523,1531,1543,1549,1553,1559,1567,1571,1579,1583,1597,1601,1607,1609,1613,1619,1621,1627,1637,1657,1663,1667,1669,1693,1697,1699,1709,1721,1723,1733,1741,1747,1753,1759,1777,1783,1787,1789,1801,1811,1823,1831,1847,1861,1867,1871,1873,1877,1879,1889,1901,1907,1913,1931,1933,1949,1951,1973,1979,1987,1993,1997,1999,2003,2011,2017,2027,2029,2039,2053,2063,2069,2081,2083,2087,2089,2099,2111,2113,2129,2131,2137,2141,2143,2153,2161,2179,2203,2207,2213,2221,2237,2239,2243,2251,2267,2269,2273,2281,2287,2293,2297,2309,2311,2333,2339,2341,2347,2351,2357,2371,2377,2381,2383,2389,2393,2399,2411,2417,2423,2437,2441,2447,2459,2467,2473,2477,2503,2521,2531,2539,2543,2549,2551,2557,2579,2591,2593,2609,2617,2621,2633,2647,2657,2659,2663,2671,2677,2683,2687,2689,2693,2699,2707,2711,2713,2719,2729,2731,2741,2749,2753,2767,2777,2789,2791,2797,2801,2803,2819,2833,2837,2843,2851,2857,2861,2879,2887,2897,2903,2909,2917,2927,2939,2953,2957,2963,2969,2971,2999,3001,3011,3019,3023,3037,3041,3049,3061,3067,3079,3083, } ;long index ; static long last_t = −1; static long powers[SIEVE_MAX]; if(t != last_t) { // compute 2^(∧)(2t−4) modulo each prime in primes. longprime ; if ( t != 1 + last_t) { // do a full computation . . . long_treduced ; for( index = 0 ; index < SIEVE_MAX; index ++) { prime =primes[index]; // reduce t by Fermat's little theorem t_reduced = (2*t −4) % (prime−1) ; // compute power by repeated doubling . . . // forlarger moduli, would need square and multiply powers[index] = 1; for(long i = 0; i < t_reduced; i++) { powers[index] += powers[index] ;powers[index] %= prime ; } } } else { // t == 1 + last_t ; // just do anupdate of the last computation . . . for( index = 0 ; index < SIEVE_MAX;index ++ ) { prime = primes[index]; // double twice . . . for (long i =0; i < 2; i++) { powers[index] += powers[index] ; powers[index] %= prime; } } } last_t = t ; } // now powers[index] is 2^(∧)(2t−4) modprimes[index]. for (index = 0 ; index <SIEVE_MAX; index ++ ){ long power= powers[index]; long prime = primes[index]; long tester ; // check forsmall factors in 3s // recall 3s = 2^(∧)(2t−3) + 1 + 3z(6z+2u) tester =2*power + 1 + 3*z*(6*z + 2*u) ; if (0 == tester%prime ) { return false ;} // check for small factors in 2*r // recall 2r = 2^(∧)(2t−4) +z(9z+3u) tester = power + z * (9*z + 3*u) ; if (0 == tester%prime ) {return false ; } // check for small factors in q // recall q =2^(∧)(2t−2) + (6z+u)^(∧)2 tester = 4*power + (6*z+u)*(6*z+u) ; if (0 ==tester%prime ) { return false ; } // check for small factors in p //recall p = 2^(∧)(2t) + (12z+2u+1)^(∧)2 tester = 16*power +(12*z+2*u+1)*(12*z+2*u+1); if (0 == tester%prime ) { return false ; } }return true ; // sieving passed } bool mod_test (long t, long z, long u){ // Quickly check p,q,r,s for small prime factors, without any big //integer math. // Primes 2 and 3 are special cases handled in thisfunction, // because divisions by 2 and 3 are involved, we must workmodulo // powers of 2 and 3. // Primes 5 and larger handled moresystematically by a call to // another function. // Here are thedefinitions of p,q,r,s in terms of t,z,u. // p = 2^(∧)(2t) +(12z+2u+1)^(∧)2 // q = 2^(∧)(2t−2) + (6z+u)^(∧)2 // r = 2^(∧)(2t−5) +z(9z+3u)/2 // s = (2^(∧)(2t−3) + 1)/3 + z(6z+2u) // Ensure that p,q,r,sare odd. // Each of p,q,s is even+odd=odd. Only r must be checked. // Weonly need that z(9z−3u) is not divisible by four. // Working mod 4, wesee that we z(z+u) = 2 mod 4. We know // it will be 0 or 2 (or −2 for%), so we eliminate 0.) if (0 == (z*(z+u))%4){ return false ; } //Second ensure that r and s are not divisible by 3. // Mod 3: // p = 1 +(2u+1)^(∧)2 = 1 + (0 or 1) = 1 or 2 // q = 1 + (1 or 2)^(∧)2 = 1 + 1 = 2// r = 2 + 0 = 2 // So, p,q,r are not divisibl by 3. // To handle s, weconsider 3s mod 9, and check that it is 3 or 6, // or really that it isnot 0. // Mod 9: 3s = 2^(∧)(2t−3) + 1 + 6uz. // we can compute(2^(∧)(2t−3) + 1) mod 9 by table lookup. if ( 0 == ((long [ ]) {0,6,3}[t%3] + 6*u*z)%9) { return false ; } // Finally, let's sieve modulosmall primes. return five_or_more_test(t,z,u) ; } long prime_test (longt, long z, long u) { ZZ p,q,r,s ; long y; y = 6*z + u ; // to do: //instead of calling power2_ZZ below, we should instead // re-use previousvalue and then double // also we should avoid the the / // theseefficiencies are probably dominated by the // cost of calling ProbPrime. . . so we defer them. p = power2_ZZ(2*t) + (2*y+1)*(2*y+1) ; q =power2_ZZ(2*t−2) + y*y ; r = (q−1)/8 ; s = (q+1)/6 ; // The modulartests and the form of y should ensure that the // divisions above areexact. if( ProbPrime(s) && ProbPrime(r) && ProbPrime(q) && ProbPrime(p)){ cout << “\r (t,z,u) = (” << t << “,” << z << “,” << u << ”) ” << “ ”<< “\b\b\b\b\b\b\b” // over-write “progress” << “\t” // since, tab doesnot over-write. ; if (t >= 127) { cout << “probably generates q-strongECDH parameters,\n”; } else { cout << “too small, otherwise special . ..\n” ; } return 1; } return 0; } long test_t_z_u (long t, long z, longu) { // first do some small-integer modular tests: if (mod_test(t,z,u)){ // If the small integer tests pass, then do big-integer primality //tests: return prime_test(t,z,u) ; } return 0; } long test_t_z (long t,long z) { long hits = 0; hits += test_t_z_u(t,+z,+1); hits +=test_t_z_u(t,+z,−1); if (z > 0) { hits += test_t_z_u(t,−z,+1); hits +=test_t_z_u(t,−z,−1); } return hits ; } int main ( ) { long t, z, hits;long t_max = T_MAX; long t_min = (T_MAX>128)? 3 : 126; cout << “Lookingfor an elliptic curve with: \n” << “ \n” << “1) complex multiplicationby i, \n” << “ enabling Gallant--Lambert--Vanstone speed-up.\n” << “Curve equation: y^(∧)2 = x^(∧)3 + ix. \n” << “2) a special fieldsize:\n” << “ p = 2^(∧)(2t) + (12z+2u+1)^(∧)2, where u^(∧)2 = 1, \n” <<“ which may be moreefficienct than a random field size.\n” << “3)cofactor 4, a curve size of 4q, for prime, \n” << “ q = 2^(∧)(2t−4) +(6z+u)^(∧)2 \n” << “ which enables Montgomery and Edwards speed-ups. \n”<< “4) near-optimal Cheon-resistance: \n” << “ r=(q−1)/8 and s=(q+1)/6.\n” << “ are both prime.\n” << “ \n” ; cout << “Testing t with ” <<t_min << “ <= t <=” << t_max << “ and |z| <=” Z_STRING “.\n”; for (t =t_min ; t <= t_max ; t++) { // test each z for (z = 0, hits=0 ; (z <=Z_ABS) && (hits <= 4); z++) { hits += test_t_z(t,z) ; if(0==(z+1)%100000) { // did not check if cerr over-writes any cout hits:( cerr << “\r” << “Progressed past t == ” << t << “, |z| <= ” << z < “”; } } // Display current value of t cerr << “\r” << “Progressed past t<= ” << t << “ ” } cout << “\n” << “Done!” << “\n” ; return 0; }

The invention claimed is:
 1. A method for providing Cheon-resistancesecurity for a static elliptic curve Diffie-Hellman cryptosystem (ECDH),the method comprising: at a first computing device, selecting a curvefor message communication between the first computing device and asecond computing device, the selecting comprising: choosing a range ofcurves having a threshold efficiency and without intentionalvulnerabilities; and electing, from the chosen range of curves, a curvewith Cheon resistance, the electing comprising electing a curve from anadditive group of order q, wherein q is prime, such that q−1=cr andq+1=ds, where r and s are primes and c and d are integer Cheon cofactorsof the group, such that cd≤48; selecting a private key for the firstcomputing device; computing a public key for the first computing devicefrom curve parameters of the curve with Cheon resistance and the privatekey for the first computing device; transmitting the curve parameters ofthe curve with Cheon resistance and the public key for the firstcomputing device to the second computing device; receiving a public keyfor the second computing device; computing a shared secret based on thepublic key for the second computing device and the private key for thefirst computing device; and communicating with the second computingdevice using the shared secret.
 2. The method of claim 1, wherein thechoosing comprises choosing a range of curves having a length matching athreshold security level.
 3. The method of claim 1, wherein the choosingcomprises selecting curves having a field size close to a power of two,and having efficient endomorphism.
 4. The method of claim 1, wherein thechoosing comprising excluding curves which are non-compact or difficultto generate.
 5. The method of claim 1, wherein the curve has an affineequation in the form y²=x³+ix, where i=√{square root over (−1)}.
 6. Themethod of claim 5, wherein the curve has length of 454 bits.
 7. Themethod of claim 6, wherein a field size p=2⁴⁵⁴+(3×17×11287)²; orderq=2⁴⁵²+(7×41117)²; r=(q−1)/8; and s=(q+1)/6.
 8. A computing device forproviding Cheon-resistance security for a static elliptic curveDiffie-Hellman cryptosystem (ECDH), the computing device comprising ahardware processor for executing program instructions configured to:select a curve for message communication between the computing deviceand a second computing device, the selecting comprising: choosing arange of curves having a threshold efficiency and without intentionalvulnerabilities; and electing, from the chosen range of curves, a curvewith Cheon resistance, the electing comprising electing a curve from anadditive group of order q, wherein q is prime, such that q−1=cr andq+1=ds, where r and s are primes and c and d are integer Cheon cofactorsof the group, such that cd≤48; and select a private key; compute apublic key from curve parameters of the curve with Cheon resistance andthe private key; transmit the curve parameters of the curve with Cheonresistance and the public key to the second computing device; receive apublic key for the second computing device; compute a shared secretbased on the public key for the second computing device and the privatekey; and communicate with the second computing device using the sharedsecret.
 9. The computing device of claim 8, wherein the processor isconfigured for choosing using curves having a length matching athreshold security level.
 10. The computing device of claim 8, whereinthe processor is configured for choosing using curves having a fieldsize close to a power of two, and having efficient endomorphism.
 11. Thecomputing device of claim 8, wherein the processor is configured forchoosing by excluding non-compact or difficult to generate.
 12. Thecomputing device of claim 8, wherein the curve has an affine equation inthe form y²=x³+ix, where i=√{square root over (−1)}.
 13. The computingdevice of claim 12, wherein the curve has length of 454 bits.
 14. Thecomputing device of claim 13, wherein a field size p=2⁴⁵⁴+(3×17×11287)²;order q=2⁴⁵²+(7×41117)²; r=(q−1)/8; and s=(q+1)/6.
 15. A non-transitorycomputer readable medium for storing instruction code for providingCheon-resistance security for a static elliptic curve Diffie-Hellmancryptosystem (ECDH), the instruction code, when executed by a processorof a first computing device causing the first computing device to:select a curve for message communication between the computing deviceand a second computing device, the selecting comprising: choosing arange of curves having a threshold efficiency and without intentionalvulnerabilities; and electing, from the chosen range of curves, a curvewith Cheon resistance, the electing comprising electing a curve from anadditive group of order q, wherein q is prime, such that q−1=cr andq+1=ds, where r and s are primes and c and d are integer Cheon cofactorsof the group, such that cd≤48; and select a private key; compute apublic key from curve parameters of the curve with Cheon resistance andthe private key; transmit the curve parameters of the curve with Cheonresistance and the public key to the second computing device; receive apublic key for the second computing device; compute a shared secretbased on the public key for the second computing device and the privatekey; and communicate with the second computing device using the sharedsecret.
 16. The non-transitory computer readable medium of claim 15,wherein the first computing device is caused to choose a range of curveshaving a length matching a threshold security level.
 17. Thenon-transitory computer readable medium of claim 15, wherein the firstcomputing device is caused to choose by selecting curves having a fieldsize close to a power of two, and having efficient endomorphism.
 18. Thenon-transitory computer readable medium of claim 15, wherein the firstcomputing device is caused to choose by excluding curves which arenon-compact or difficult to generate.
 19. The non-transitory computerreadable medium of claim 15, wherein the curve has an affine equation inthe form y²=x³+ix, where i=√{square root over (−1)}.
 20. Thenon-transitory computer readable medium of claim 19, wherein the curvehas length of 454 bits.
 21. The non-transitory computer readable mediumof claim 20, wherein a field size p=2⁴⁵⁴+(3×17×11287)².